Find what you’re looking for
Browse everything
6,854 results in Threat Reports
Active Exploitation of WSO2 API Manager JWT Bypass Highlights Critical API Security Gaps
In September 2026, watchTowr researchers detected active exploitation of CVE-2026-5430, a critical JWT authentication bypass vulnerability in WSO2 API Manager products. The flaw allows attackers to forge JWT tokens with administrative privileges by using unsupported cryptographic algorithms that the system incorrectly validates. Threat actors are leveraging this vulnerability to gain unauthorized access to API backends, extract consumer keys and secrets, and potentially compromise entire API ecosystems. The vulnerability affects multiple WSO2 products including API Manager versions 4.1.0 through 4.6.0, with exploitation attempts captured in honeypot networks showing forged admin tokens being used for lateral movement. This incident highlights the growing sophistication of API-targeted attacks as organizations increasingly rely on API-first architectures. The vulnerability demonstrates how improper cryptographic validation can lead to complete administrative takeover, emphasizing the urgent need for robust API security controls and zero-trust verification mechanisms.
CVE-2026-87886: Acronis cPanel Backup Plugin Under Active Attack
Acronis disclosed that CVE-2026-87886, a high-severity privilege escalation vulnerability in its Backup plugin for cPanel and WHM deployments, has been actively exploited in targeted attacks. The flaw, scoring 7.8 on CVSS, stems from insecure file permissions that allow attackers with low-level access to escalate privileges on vulnerable Linux systems. Successful exploitation enables unauthorized actions and arbitrary code execution, potentially compromising application confidentiality and integrity across web hosting environments. This incident highlights the growing trend of supply chain vulnerabilities targeting managed hosting infrastructure, where a single compromised plugin can provide attackers with elevated access across multiple customer environments. The active exploitation underscores the critical need for immediate patch management in hosting environments where administrative tools create expanded attack surfaces.
N0va Phishing Campaign Exploits Trusted Business Platforms to Compromise Enterprise Identities
The N0va phishing campaign has emerged as a sophisticated threat targeting organizations across North America and Europe in 2026, focusing on government, technology, consulting, and healthcare sectors. Unlike traditional phishing attacks, N0va impersonates trusted business platforms including Microsoft Teams, SharePoint, OneDrive, DocuSign, and Google Drive, then guides victims through legitimate authentication flows to capture access and refresh tokens. Once successful, attackers abuse token-exchange mechanisms to establish SSO access across corporate resources, enabling access to email, files, and cloud applications without deploying obvious malware. The campaign's use of legitimate authentication processes and trusted brand impersonation makes detection challenging and can lead to significant financial losses, data exposure, operational disruption, and compliance violations. This incident highlights the evolving sophistication of identity-based attacks that exploit trust in legitimate business platforms and authentication mechanisms, representing a growing trend where attackers move beyond traditional malware deployment to abuse valid business processes for initial access and persistence.
Critical Google Pixel Modem Flaw CVE-2026-58704 Exploited in Zero-Click Attacks
In September 2026, Google disclosed that CVE-2026-58704, a high-severity privilege escalation vulnerability in Pixel Cellular Modem components, was being exploited in the wild through limited, targeted attacks. The flaw allows remote attackers to bypass permission checks and escalate privileges without user interaction, making it exploitable as a zero-click attack. Google patched the vulnerability alongside 109 other security flaws in the September 2026 Pixel security update, with CISA adding it to the Known Exploited Vulnerabilities catalog and mandating federal agency remediation by September 19, 2026. This incident highlights the growing sophistication of mobile device attacks and the critical importance of securing cellular modem components that were previously considered peripheral attack surfaces. The zero-click nature of this exploit represents an evolution in mobile threat tactics, emphasizing the need for comprehensive mobile security strategies that extend beyond traditional application-layer protections.
Google Pixel Authorization Flaw CVE-2026-58704 Under Active Attack
CISA added CVE-2026-58704, a Google Pixel improper authorization vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. This vulnerability affects Google Pixel mobile devices and allows attackers to bypass authorization controls, potentially gaining elevated access to device functions and sensitive data. The vulnerability poses significant risks to federal enterprises and organizations using Google Pixel devices in their mobile device management programs. Federal agencies are required under BOD 26-04 to prioritize rapid remediation of KEV vulnerabilities on publicly exposed assets that could grant total control post-exploitation. This addition reflects the growing threat landscape targeting mobile device vulnerabilities, particularly as organizations increasingly rely on mobile endpoints for business operations and remote work scenarios.
ParaShells Vulnerability: When Virtualization Security Becomes a Privilege Escalation Pathway
In September 2026, JFrog's vulnerability research team discovered CVE-2026-90894, a local privilege escalation flaw in Parallels Desktop for Mac that allows non-administrative users to execute code with root privileges. The vulnerability, dubbed 'ParaShells,' exploits a world-writable socket in the prl_disp_service background service and uses argument injection in the virtual machine appliance installation process. While the attack requires local access, it poses significant risks in shared environments or when combined with other attack vectors like malicious Homebrew formulas or compromised npm scripts. This incident highlights the growing concern around local privilege escalation vulnerabilities in virtualization software, particularly as organizations increasingly rely on virtual machines for development and testing. The timing is especially critical as Apple has discontinued Intel Mac support in newer versions, leaving Intel-based systems without access to the patched version 27, creating a prolonged exposure window for legacy hardware deployments.
AMOS Stealer Campaign Exposes Growing macOS Threat Landscape
In August 2026, Unit 42 researchers documented an active Atomic macOS (AMOS) stealer campaign targeting macOS systems through fake software installation pages. The malware, distributed via malicious websites claiming to offer cracked macOS toolkits, uses social engineering to trick users into executing terminal commands that download and install the stealer. AMOS exfiltrates sensitive data including login credentials, cryptocurrency wallet information, browser data, and system files before transmitting them to command and control servers. The attack demonstrates sophisticated persistence mechanisms, creating hidden directories in system locations and requesting extensive permissions to access user files and applications. This incident highlights the growing threat of macOS-targeted malware as cybercriminals increasingly focus on Apple systems previously considered more secure. The rapid evolution of AMOS stealer infrastructure, with frequently changing domains, IP addresses, and file hashes, represents a concerning trend in malware development that challenges traditional signature-based detection methods.
Attackers Weaponize AI Coding Assistants in Major Supply Chain Breach
In September 2026, Mandiant reported a sophisticated supply chain attack where threat actors hijacked an active AI coding assistant session at an unnamed SaaS provider. The attackers manipulated the AI assistant to recommend poisoned software packages, which when accepted by developers, deployed the Shai-Hulud worm across approximately 100 internal code repositories. The attack resulted in theft of GitHub OAuth tokens, repository secrets, and proprietary source code, while also poisoning packages in the company's official namespace to enable secondary infections. This incident represents a critical evolution in supply chain attacks, demonstrating how AI-assisted development environments can be weaponized to amplify traditional attack vectors. The targeting of AI coding assistants reflects the growing threat landscape as organizations increasingly integrate AI tools into their development workflows without adequate security controls.
Active Zero-Day Exploitation Targets Cisco Email Security Infrastructure
In September 2024, Cisco disclosed CVE-2026-76461, a critical zero-day vulnerability in Cisco Secure Email Gateway that was actively exploited by unknown threat actors before discovery and patching. The vulnerability allows unauthenticated remote attackers to execute commands with root privileges by sending specially crafted emails through the gateway, effectively granting complete control over the system. Cisco's security team identified active exploitation affecting multiple customers and conducted direct outreach to compromised organizations while implementing emergency mitigations for cloud-managed instances. This incident highlights the growing sophistication of attacks targeting email infrastructure as critical business communication channels become prime targets for espionage and lateral movement operations.
Coast Guard and FBI Investigate Maritime Cyberattacks on Foreign Tankers
In August 2024, the U.S. Coast Guard and FBI conducted joint offshore security boardings of two foreign commercial tankers in the Gulf of Mexico following cyberattacks that compromised their networks. The first vessel, carrying oil and natural gas, was hacked while transiting the Strait of Gibraltar and lost communications for over 30 hours. Authorities investigated potential Iranian involvement or threat actors exploiting U.S.-Iran tensions, as part of broader concerns about 'dark fleets' carrying sanctioned oil using digital masking techniques. This incident highlights the growing convergence of cybersecurity threats with critical infrastructure and supply chain security, particularly as nation-state actors increasingly target maritime operations to disrupt global commerce and energy transportation networks.
Critical Cisco Email Gateway Zero-Day Highlights Perimeter Security Risks
In September 2026, Cisco disclosed that threat actors were actively exploiting a critical zero-day vulnerability (CVE-2026-76461) in Cisco Secure Email Gateway appliances. The flaw stems from insufficient validation in email parsing logic, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges by sending crafted emails containing malicious SQL statements. CISA immediately added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies patch within three days. This incident represents the latest in a concerning pattern of Cisco security appliance compromises, with CISA flagging 98 Cisco vulnerabilities as actively exploited since 2021, including seven abused by ransomware gangs.
Ransomware Gangs Exploit Critical VMware vCenter RCE Flaw (CVE-2026-59310)
In July 2026, Broadcom patched CVE-2026-59310, a critical directory traversal vulnerability in VMware vCenter's Syslog server that allows unauthenticated remote code execution. Despite urgent patching guidance, threat actors quickly began exploiting the flaw within weeks, with QUIRSO identifying over 361 compromised IP addresses across 47 countries. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog in August and recently flagged it as actively exploited by ransomware gangs, highlighting the critical risk to enterprise virtualization infrastructure. This incident underscores the accelerating timeline between vulnerability disclosure and ransomware exploitation, particularly targeting VMware environments that serve as high-value infrastructure targets for enterprise data access and lateral movement capabilities.